LastPass Customer Data Exposed in Klue Supply Chain Attack Using Stolen OAuth Tokens

LastPass disclosed that a security incident at third-party platform Klue led to compromised OAuth tokens, which attackers used to access limited customer CRM data in LastPass's Salesforce instance (names, emails, phone numbers, addresses, and support/sales records). LastPass states core infrastructure and encrypted password vaults were not impacted, revoked and rotated affected tokens, disabled Klue access, shared IoCs (IPs and domains), and advised customers to audit integrations and enforce strict token and access controls.